When Mark Chay took on the role of general manager in a company in Shanghai, China, he uncovered the corruption practices that had been carried out by his predecessor.
He immediately issued a memo to his subordinates, ordering them to stop such acts. Three months later, the authorities showed up at the office one day just before 5pm and interrogated the employees.
Eventually, the former general manager was charged and sentenced to 10 years in jail.
“If I had continued the practice, I would be arrested as well,” shared Chay, who is now the chief executive officer of Coalition for Business Integrity (CBI), a non-profit organisation championing integrity for a better Malaysia.
His experience illustrates the risks a company faces when corruption infiltrates business practices. A major governance issue, corruption undermines corporate integrity, public confidence and economic growth.
Closer to home, the Malaysian Anti-Corruption Commission (MACC) had said in 2024 that Malaysia lost RM277bil in national revenue over a period of five years from 2018 to 2023 to corruption and collusion among people entrusted with government funds.
Emir Research put the potential loss at a staggering RM4.5 trillion between 1997 and 2022, combining both direct losses and the multiplier effect of lost economic opportunity.
For companies, three elements are important in anti-corruption governance: board commitment, effectiveness of control and oversight in the form of monitoring and assurance, said VisionEthics Advisory Services Sdn Bhd co-founder and principal consultant Radhika Nandrajog.
“If you get top level commitment from the board of the organisation, the majority of the battle is over. Without it, you will be restrained in terms of resources, commitment and culture.”
With mandatory sustainability reporting being phased in and greater attention paid to ESG, VisionEthics has seen a rise in demand for anti-bribery training and gap assessment from companies big and small, including banks, construction firms and insurance companies.
“Without the G, it would be challenging to implement the E and S. That is because without appropriate governance, top-level commitment and the measure of effectiveness, you can forget about environmental and social being implemented,” Radhika said.
The problem
Across South-East Asia, Malaysia ranked third among its Asean peers with a score of 52 out of 100 in the Corruption Perception Index 2025 published by Transparency International. Indonesia shared the sixth spot with Laos with a score of 34, while Philippines’ score of 32 placed it ahead of Cambodia and Myanmar.
CBI chairman Chew Phye Keat said the saddest – and most dangerous – aspect of corruption in Malaysia is that it has become an accepted business culture. Companies may believe they cannot survive without offering bribes, while employees fear losing their jobs if they refuse to participate in corrupt practices.
Those who get involved may not always see the full consequences of what they are doing, he added. “They think they are not hurting anybody.”
Citing a paper by CBI and Institute for Democracy and Economic Affairs, Chay said the cost of bribery is often factored into the prices of goods and services, including houses, with some carrying an additional 20% and 30% in bribery value.
For businesses that are pressured into giving bribes or risk having their applications stalled, he acknowledged the predicament.
“We understand the situation, but we advocate having the courage to stand up. If there are more voices standing together, it will be very effective.”
TRUST
Section 17A of the MACC Act 2009, which took effect in June 2020, establishes corporate criminal liability for corruption. A company can be held liable if an employee or associated person commits corruption for the organisation’s benefit.
The penalty is a fine of RM1mil or 10 times the sum of the gratification, whichever is higher, or a jail term not exceeding 20 years, or both.
To guide companies to put in place adequate procedures to prevent their employees or associated persons from undertaking corrupt conduct, MACC recommended the Adequate Procedures TRUST principles: top level commitment; risk assessment; undertake control measures; systematic review, monitoring and enforcement; and training and communication.
Radhika cited an international case where an organisation was investigated after a high-ranking employee was found to have engaged in bribery and corruption involving a government official.
In the end, the authorities did not bring enforcement action against the company as it demonstrated that it had an effective compliance control and programme in place, and that the employee acted on his own against company policy.
The employee was charged on the basis of not adhering to company internal controls and making false representation for personal profit.
How adequate is adequate
Bursa Malaysia requires all listed companies and their boards to establish policies and procedures on anti-corruption and whistleblowing, review them periodically for effectiveness and include corruption risk in annual risk assessment.
The question, however, is how often companies have comprehensive policies on paper but struggle to enforce them in real life effectively.
To determine whether a company’s adequate procedures are adequate, VisionEthics’ proprietary effectiveness indicators methodology first looks at the existence of policies and procedures, followed by whether they have actually been implemented to address corruption risks, as well as whether the company achieves the outcome for detecting and preventing corrupt practice and building the culture of integrity.
Monitoring and evaluation is equally important to ensure continuous improvements.
“Do the policies address corruption risks? Many companies practise a strong stance on accepting but a bit more subdued on the offering of gratification and/or offering of gratification by third parties operating on behalf of the organisation.
“The question we then ask is, have they been able to identify and address corruption risks in the policy to start with?” Radhika said.
The next step is to examine the effectiveness of the controls in addressing the risk.
“Are there loopholes? For example, the policy may have thresholds on gifts, entertainment or hospitality. However, the thresholds cover the amount but are more silent on frequency. A weekly threshold may be low but the frequency in a year will add up to a significant amount and this may be associated with intention to use as a gratification,” she said.
Measuring impact
On the impact of implementation, many companies show activities such as the number of training sessions, but do not measure the effectiveness of the training to assess whether knowledge is retained and applied in day-to-day operations.
“Have there been more engagement with integrity units on the do’s and don’ts? Have there been more concerns raised after the training? Are there fewer repeated incidents?
“Otherwise, prosecution will say you just have beautiful paper policies, but no impact,” Radhika said.
Many listed companies note in their sustainability reports that there have been no reported incidents, no substantiated cases or no whistleblowing cases, while corruption risk has been assessed in high-risk areas.
“No whistleblowing cases does not mean nothing is wrong,” Radhika said. “In my opinion, the channel is there but people are scared to whistleblow. How do you overcome the fear of reporting as a board? That’s the outcome.”
All levels are responsible for monitoring and evaluation, with the ultimate responsibility lying with the board, she added.
“Board needs to set up the monitoring framework, while management needs to implement the monitoring programme.
“Compliance or integrity units need to measure the effectiveness of the anti-corruption programme, and audit comes in as the assurance that the organisation is operating in compliance with policies and regulatory requirements.”
Deferred prosecution agreement
While anti-bribery management systems (ABMS) are more common among public-listed companies, many unlisted companies have yet to have put such systems in place.
Chay opined that cost is one consideration, while the other being a perception that enforcement focuses mainly on big scandals.
Chew observed that Section 17A of the MACC Act has not been used on small and medium enterprises (SMEs). Six years since the provision came into force, relatively few companies have been charged under Section 17A, potentially contributing to a perception that the risk of enforcement remains low, he said.
One possible solution, he said, could be deferred prosecution agreement, a mechanism allowing the prosecution to defer on agreed conditions..
“I do not want to put SMEs out of business, so I enter into an agreement with you,” he explained. For instance, a company may be given six months to put the procedures in place, with progress reported to the authorities every two months.
“In six months’ time, I will do an audit on you. If you fulfil all these requirements, then I will let it go. If you fail the audit, then the punishment will come.
“That’s what I am hoping will be the next step to make Section 17A work across all businesses,” Chew said.
